In telephony today, the signaling messages and information used to: (i) establish and tear down a call, and (ii) to conduct transactions, often pass through one or more intermediary networks, e.g., interchange carriers, hub providers, on the way from their originator to their intended destination. Carriers, e.g., local carriers, have a number of reasons to implement call and transaction monitoring systems that collect, correlate, and compare the information that leaves an originating network with the information that enters a terminating network. These reasons include: maintaining and monitoring service assurance, troubleshooting problems, and detecting fraudulent manipulation of signaling information. Signaling messages and information for analysis are often collected by trapping and storing messages sent from a number of different sources towards a common destination or set of destinations. Those destinations could be anything from single telephone number to a set of telephone end offices, or even to all the switches in a Local Access and Transport Area (LATA). Because of the possibility that some identifying information within these messages may be modified or removed, it has been necessary to trap and save messages, e.g., all messages of the type being monitored e.g., call setup, addressed to the targeted destinations. The correlation of messages trapped by both the originating and terminating networks normally takes place offline and after the fact. Messages from the originating network can be selected for storage, based on their characteristics e.g., called number, thus limiting the number of messages that must be collected and stored by the originating network. In contrast, the relevance of messages entering the terminating network is not immediately clear, and is only determined through subsequent processing. As a result, a large number of messages, irrelevant to a particular study, are often collected at the terminating network along with those messages that are relevant. This may present logistical difficulties with regard to both the storage required to hold the saved messages, as well as the additional processing required to analyze them.
Currently, at least one known telephone carrier tracks and logs information on all calls (both originating and terminating) that pass through monitored portions of their network at different network locations. This results in information being logged for many calls where no corresponding source/destination information will be available, since the calls may originate or terminate at a different carrier's network or an unmonitored portion of the monitoring carrier's own network. Logs generated by the deployed monitoring equipment are collected into a large database and then processed offline to correlate calls leaving and re-entering the known telephone carrier's network. As discussed above, many calls and transactions for which data is collected either do not originate, or do not terminate within the monitored portions of the network(s). Thus there may be no correlation between many, if not most, of the many call setup and/or transaction messages collected from the originating and terminating networks. Originating and terminating data that can be correlated to document a call or transaction can be checked to determine whether any fields were inappropriately altered after leaving the originating telephone carrier's network prior to re-entry into the destination carrier's network.
The current monitoring and correlation system of the known telephone carrier, while effective, creates a huge volume of data that must be stored and then processed to correlate calls and/or transactions leaving and re-entering the known telephone carrier's network. The current existing known telephone carrier's system is a non-real time system since the call correlation process is done off-line, after data has been gathered and transferred to a common processing facility. The off-line processing is, in part, a reflection of the vast amounts of data that must be processed to correlate messages and/or transactions detected at different network locations. Thus, there will be some delay between when an inappropriate modification occurs and when it is actually detected.
FIG. 1 is a drawing of an exemplary communications system 100 using known data capture and storage methods and apparatus for call monitoring. System 100 includes a first origination network 102, a second origination network 104, a third origination network 106, an intermediate network 108, and a destination network 110. Calls, transactions and associated information from the first and second, networks 102, 104 are delivered to the destination network 110 through intermediate network 108 which interconnects origination networks 102, 104 to the destination network 110. Originating network 3, 106 connects both to the intermediate network, 108 and the destination network, 110. While calls and/or transactions from originating network 3 106 to destination network 110 are often signaled directly between the two networks, it is also possible for originating network 3, 106 to use an intermediate network 108 to reach the destination network 110. The switches 114, 122, 130, 134 are connected to local Signal Transfer Points (STPs) 113, 123, 133, 134, respectively, which may also include the corresponding signal monitoring equipment. Signaling information exchanged between networks is transferred over the signaling links, 144, 148, 148, 150 and various other links between origination network 3, 106 and destination network 110 connecting their respective STPs. Note that while the figure shows STPs being present in each network, smaller networks will often forgo deployment of STPs and instead connect their switches directly to the STPs of a larger carrier.
The destination network 110 is located in LATA 1 of state 1. Origination network 3, 106 is also located in LATA 1 of state 1. Calls and/or transactions from origination network 3, 106 directed to destination network 110 are considered local and are often signaled directly, rather than through an intermediate network. Origination network 2, 104 is located in LATA 2 of state 1. Calls and/or transactions from origination network 2, 104 placed to destination network 110 are considered intra-state, inter-LATA. Origination network 1, 102 is located in LATA 3 of state 2. Calls and/or transactions from origination network 1, 102 placed to destination network 110 are considered inter-state[Covered above].
Origination network 1, 102 includes at least one telephone 112, a switch 114, and signal monitoring equipment 116. It is also likely to include a pair of Signaling Transfer Points (STPs) 113. Similarly, origination network 2, 104 includes at least one telephone 120, a switch 122, and signal monitoring equipment 124 and most likely a pair of STPs 123. Origination network 3, 106 includes at least one telephone 128 and switch 130, and possibly a pair of STPs 133. Intermediate network 108, e.g., an interchange carrier includes switch 132 and a pair of STPs 135. Destination network 110 includes a switch 134, a plurality of telephones 136, 137, 138, received signaling monitoring equipment 140, a storage area 142 and most likely, a pair of STPs 143.
Deployed monitoring equipment can, and often does, monitor signaling for both originating and terminating calls. For purposes of explaining the invention, some monitoring equipments have been shown as monitoring call origination signaling exclusively, while others have been shown as monitoring only termination signaling.
A call is initiated from telephone 112 toward a phone in destination network 110, e.g., telephone 136, which results in switch 114 generating signaling message(s) 144, e.g., an SS7 Initial Address Message (IAM). Signaling messages 144, generated by and output from switch 114, are monitored by the signal monitoring test equipment, e.g., passive link-monitoring equipment, and selectively recorded in a log 118 by signal monitoring equipment 116. The selection may be based, e.g., on a called number or block of numbers associated with destination network 110. The signaling messages 144 are received by switch 132 of intermediate network 108. Certain information in the signaling message(s), e.g., information that will be used by destination network 110 to classify the call as long distance call should not be altered by intermediate network 108 during the forward routing, but may be altered. Such alterations may make the call appear to the destination network 110 as an intra-state interLATA, or local call, resulting in improper billing and a loss of revenue to destination network 110 due to fraud on the part of the intermediate network 108.
Alternatively, intermediate network 108 could forward the call to Origination network 3, 106, which could then pass it on to destination network 110. Such behavior, coupled with alterations to call signaling data can definitely give the call the appearance of a local call.
Similarly, when a call is initiated from telephone 120 to a phone in destination network 110, e.g., telephone 137, switch 122 generates signaling message(s) 146, e.g., an SS7 Initial Address Message (IAM). Signaling messages 146, originated by and output from switch 122, are monitored by the signal monitoring test equipment 124, e.g., link-monitoring equipment, and selectively recorded in a log 126 by signal monitoring equipment 124. The selection may be based, e.g., on a called number or block of numbers associated within destination network 110. The signaling messages 146 are received by switch 132 of intermediate network 108. Certain information in the signaling message(s), e.g., information that will be used by destination network 110 to classify the call as an intra-state interLATA call should not be altered by intermediate network 108 during the forward routing, but it sometimes is. Such alterations may make the call appear to the destination network 110 as a local call, or an interstate call, resulting in improper billing and a loss of revenue to destination network 110 due to fraud on the part of the intermediate network 108.
In some cases, when a call is initiated from telephone 128 in origination network 3, 106, toward a telephone in destination network 110, e.g., telephone 138, switch 130 generates signaling message(s) 148, e.g., an SS7 Initial Address Message (IAM). The signaling messages 148 are received by switch 132 of intermediate network 108.
Switch 132 of intermediate network 108, receives the signaling messages, e.g., IAM SS7 signaling messages from origination networks 102, 104, 106, processes the messages 144, 146, 148, and outputs signaling messages 150 directed to switch 134 of destination network 110. Received signal monitoring equipment 140 captures the incoming signaling messages 150, and stores the detected information in storage area 142, e.g., a high capacity storage device, for future processing and analysis. Received signal monitoring equipment 140 monitors the incoming calls and transactions, e.g., the SS7 messages, to the target portion of the network, e.g., directed to switch 134. Since the received signal monitoring equipment needs to account for the possibility that signaling information has been modified in transit, or that it may arrive over an unconventional route, it is obligated to collect and store incoming messages, e.g., all incoming SS7 messages, initiating a call or transaction to the targeted part of the network. As a result, the data storage requirements of the terminating network in storage area 142 are far greater than those of the originating network(s), e.g., logs 118, 126. The originating network 102, 104 need only save messages pointing toward the targeted portion of the terminating network 110, but the terminating network 110 needs to save all incoming messages that initiate either a call or a transaction.
System 100 also includes a processing center 152 including origination log information 154 and destination log information 156. Origination logs (118, 126) are communicated from origination networks (102, 104) via signals (158, 160) to the processing center 152 and stored in origination log information 154; information collected and stored in storage area 142 of the destination network 110 is transferred to destination log information 156 via path 162. The processing center 152 can subsequently use the information in logs 154, 156 to perform, after the fact, message correlation and analysis of the messages trapped by the originating networks 102, 104 and the messages trapped by the destination network 110.
The processing center 152 sorts through the destination log information 156 to identify received messages corresponding to transmitted messages in the origination log information 154. Correlation is performed by comparing portions of the originally transmitted messages to portions of the corresponding received destination messages that must remain unchanged in order to provide service, e.g., portions such as the Called Party Number for calls and the Transaction ID for transactions. In the process, many, if not most, of the messages collected by the destination network 110 are discarded as irrelevant. Then, the processing center 152 can perform a detailed comparison of portions of the correlated messages that should be identical in the originating and terminating messages, but which may have been altered as the signals traversed the intermediate network 108.
FIG. 2 is a drawing of an exemplary Initial Address Message (IAM) 200 which may be captured and analyzed. While IAMs are sent solely from one switch to the following switch on a call path, and not forwarded farther, the signaling information, used to set up a telephone connection is passed from switch-to-switch-to-switch, from the originating switch to the destination switch, e.g., switch 114-switch 132-switch 134, as a call is established. Message 200 includes a header 201, a called party number 202, a calling party's number (CPN) 204, a charged number (CN) 206, a jurisdictional information parameter (JIP) 208 and other additional information 210. The called party's number 202 indicates the destination telephone number in the destination network 110, e.g., the number corresponding to telephone 136. The CPN 204 corresponds to the number of the telephone from which the call was initiated, e.g., that of telephone 112 of origination network 102. CN 206 is the number to which the call is billed. The JIP 208 includes information indicating the jurisdiction from which the call was placed, e.g., information identifying origination network 102 located in LATA 3, state 2. Most or all of information 202, 204, 206, 208 included in the fields of IAM 200 are generally provided by the switch where the call originated, e.g., switch 114, with the expectation that they will be delivered unaltered to the terminating switch, e.g., switch 134. Such information 202, 204, 206, 208 in the IAM 200 may be supplemented by additional information 210, e.g., call characteristic information. The additional information 210 may include information provided by the originating switch 114, as well as information added by the successive switches in the path, e.g., switch 132.
In view of the above discussion, it is apparent that there is a need for methods and apparatus to provide a call monitoring system that reduces the volume of signaling messages that need to be captured, stored, and recorded by a terminating network. A reduction in volume would be beneficial over existing systems in terms of reducing storage and processing requirements. In addition, call monitoring systems that do not require enormous memory storage and processing capability should be more hardware efficient and cost-effective, and could be attractive to be employed to supplement existing deployed monitoring systems, e.g., in areas where the volume of traffic has not justified the purchase and deployment of equipment which records all of the signaling messages. New call monitoring systems with reduced storage and processing requirements might also be attractive for deployment with partner carriers, e.g., carriers working together to track fraud.
In addition, new methods and apparatus directed to call monitoring systems that can operate on a near real time basis would be well suited for fraud detection.